CVSS 7.8 · High EPSS 0,27%
Kerentanan Use After Free pada linux kernel. Skor CVSS 3.1 7.8 (High) menurut NVD.
In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: avoid double fput() on failed usercopy If the copy back to userland fails for the FASTRPC_IOCTL_ALLOC_DMA_BUFF ioctl(), we shouldn't assume that 'buf->dmabuf' is still valid. In fact, dma_buf_fd() called fd_install() before, i.e. "consumed" one reference, leaving us with none. Calling dma_buf_put() will therefore put a reference we no longer own, leading to a valid file descritor table entry for an already released 'file' object which is a straight use-after-free. Simply avoid calling dma_buf_put() and rely on the process exit code to do the necessary cleanup, if needed, i.e. if the file descriptor is still valid.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| linux | linux kernel | Versi 5.1 hingga sebelum 5.4.180 |
| linux | linux kernel | Versi 5.5 hingga sebelum 5.10.101 |
| linux | linux kernel | Versi 5.11 hingga sebelum 5.15.24 |
| linux | linux kernel | Versi 5.16 hingga sebelum 5.16.10 |
| linux | linux kernel | Versi 5.17 rc1 |
| linux | linux kernel | Versi 5.17 rc2 |
| linux | linux kernel | Versi 5.17 rc3 |